CVE-2026-40033
High
Description
FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.
SeverityHigh
CVSS8.8
Exploit probability—
ProductFreerdp
PublishedMay 26, 2026
First seenMay 26, 2026
Weakness typeCWE-122CWE-122
How to fix
Update
- freerdp freerdp3.26.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freerdp freerdp | v < 3.26.0 | 3.26.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.